fix: recover interrupted stable npm releases

[rebeccahum]

Problem

The v4.1.2 release created its GitHub release and tag, then failed at npm publish. Rerunning the original action attempts to recreate the release, and its global silent npm logging hides the publish error.

Change

Add a manual recover-stable mode to the existing npm publishing workflow so trusted publishing keeps the same workflow identity and environment. Recovery builds and tests the existing stable tag, publishes it to latest with npm error logging, and runs the downstream documentation jobs. It validates the release metadata and package version, rejects already published versions and downgrades, and serializes stable publication. The existing prerelease mode remains the default.

After merging, use Actions → Publish to npm (if applicable) → Run workflow, branch trunk, release_mode: recover-stable, release_version: 4.1.2. A rerun of the original failed run will not use this change. Recovery does not create the regular action's next development-version PR; that remains a separate follow-up after publication.

Validation

• actionlint .github/workflows/npm-publish.yml (including ShellCheck): passed.
• Prettier checks for the workflow and recovery instructions: passed.
• git diff --check: passed.
• Executed 13 isolated checks against the workflow's actual shell/Node guard blocks using mocked GitHub/npm responses: passed (valid release, wrong branch, blank/malicious/prerelease input, draft/prerelease metadata, missing release, published version, downgrade, registry failure, malformed response).
• Read-only npm registry check confirmed latest is 4.1.1 and 4.1.2 is absent.
• No publish or deployment performed. Node/Go runtime and parity suites were not run because this change only affects release orchestration and documentation; the recovery run performs the tagged package's build and tests before publishing.

[github-actions]

Dependency Review

The following issues were found:

• ✅ 0 vulnerable package(s)
• ✅ 0 package(s) with incompatible licenses
• ✅ 0 package(s) with invalid SPDX license definitions
• ⚠️ 2 package(s) with unknown licenses.

See the Details below.

License Issues

.github/workflows/npm-publish.yml

Package	Version	License	Issue Type
actions/checkout	7.*.*	Null	Unknown License
actions/setup-node	7.*.*	Null	Unknown License

OpenSSF Scorecard

Package	Version	Score	Details
actions/actions/checkout	7.*.*	🟢 7	Details Check Score Reason Code-Review 🟢 10 all changesets reviewed Maintained 🟢 10 22 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10 Binary-Artifacts 🟢 10 no binaries found in the repo Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Pinned-Dependencies 🟢 3 dependency not pinned by hash detected -- score normalized to 3 Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Packaging ⚠️ -1 packaging workflow not detected Signed-Releases ⚠️ -1 no releases found Security-Policy 🟢 9 security policy file detected SAST 🟢 10 SAST tool is run on all commits Branch-Protection 🟢 6 branch protection is not maximal on development and all release branches
actions/actions/setup-node	7.*.*	🟢 6.4	Details Check Score Reason Maintained 🟢 10 21 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10 Binary-Artifacts 🟢 9 binaries present in source code Code-Review 🟢 10 all changesets reviewed Packaging ⚠️ -1 packaging workflow not detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Pinned-Dependencies 🟢 5 dependency not pinned by hash detected -- score normalized to 5 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Security-Policy 🟢 9 security policy file detected Branch-Protection ⚠️ 0 branch protection not enabled on development/release branches SAST 🟢 10 SAST tool is run on all commits

Scanned Files

• .github/workflows/npm-publish.yml

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud